{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,11,2]],"date-time":"2025-11-02T05:50:17Z","timestamp":1762062617485,"version":"build-2065373602"},"reference-count":30,"publisher":"Springer Science and Business Media LLC","issue":"4","license":[{"start":{"date-parts":[[2022,8,9]],"date-time":"2022-08-09T00:00:00Z","timestamp":1660003200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2022,8,9]],"date-time":"2022-08-09T00:00:00Z","timestamp":1660003200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"DOI":"10.13039\/501100007052","name":"Universit\u00e0 degli Studi di Verona","doi-asserted-by":"crossref","id":[{"id":"10.13039\/501100007052","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Cluster Comput"],"published-print":{"date-parts":[[2023,8]]},"abstract":"<jats:title>Abstract<\/jats:title><jats:p>This paper shows that generic types (<jats:italic>generics<\/jats:italic>) are useful for writing more abstract and more general smart contracts, but this comes with some security risks, reporting a concrete security issue found while using generics for writing smart contracts that implement <jats:italic>shared entities<\/jats:italic> for the Hotmoka blockchain. That issue can be used to steal the remuneration of validator nodes. This paper proposes a patch based on appropriate code rewriting. Namely, smart contracts are pieces of code that are deployed and executed in the context of a blockchain infrastructure in order to automatically enforce some effects when particular events occur. The writing of smart contracts is a complex and critical activity that can benefit from the use of high-level features of programming languages, and generics is one of them. In many programming languages, such as Java, generics are implemented by <jats:italic>erasure<\/jats:italic>, i.e. replaced by their upper bound type during compilation into bytecode. This is safe at source level, since the compiler takes care of checking that types are correct, before erasure. However, the erased types of the generated bytecode are consequently weaker. In a permissionless blockchain, where every user can call the bytecode of smart contracts installed by other users, these weaker types pose a risk of attack.<\/jats:p>","DOI":"10.1007\/s10586-022-03688-y","type":"journal-article","created":{"date-parts":[[2022,8,9]],"date-time":"2022-08-09T20:02:54Z","timestamp":1660075374000},"page":"2099-2113","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":2,"title":["On the use of generic types for smart contracts"],"prefix":"10.1007","volume":"26","author":[{"given":"Fausto","family":"Spoto","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3675-7243","authenticated-orcid":false,"given":"Sara","family":"Migliorini","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Mauro","family":"Gambini","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Andrea","family":"Benini","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2022,8,9]]},"reference":[{"key":"3688_CR1","doi-asserted-by":"publisher","first-page":"55","DOI":"10.1016\/j.tele.2018.11.006","volume":"36","author":"F Casino","year":"2019","unstructured":"Casino, F., Dasaklis, T.K., Patsakis, C.: A systematic literature review of blockchain-based applications: current status. Classif. Open Issues Telemat. Inform. 36, 55\u201381 (2019). https:\/\/doi.org\/10.1016\/j.tele.2018.11.006","journal-title":"Classification and Open Issues, Telematics and Informatics"},{"key":"3688_CR2","doi-asserted-by":"crossref","unstructured":"Spoto, F.: A Java framework for smart contracts. In: 3rd Workshop on Trusted Smart Contracts (WTSC\u201919). Lecture Notes in Computer Science, vol. 11599, pp. 122\u2013137. Springer, St. Kitts and Nevis (2019)","DOI":"10.1007\/978-3-030-43725-1_10"},{"key":"3688_CR3","doi-asserted-by":"crossref","unstructured":"Spoto, F.: Enforcing determinism of Java smart contracts. In: 4th Workshop on Trusted Smart Contracts (WTSC\u201920). Lecture Notes in Computer Science, vol. 12063, pp. 568\u2013583. Springer, Kota Kinabalu (2020)","DOI":"10.1007\/978-3-030-54455-3_40"},{"key":"3688_CR4","unstructured":"Nakamoto, S.: Bitcoin: a Peer-to-Peer electronic cash system (2008). https:\/\/Bitcoin.org\/Bitcoin.pdf."},{"key":"3688_CR5","unstructured":"Antonopoulos, A.M.: Mastering Bitcoin: Programming the Open Blockchain, 2nd edn. O\u2019Reilly Media, Inc. (2017)"},{"key":"3688_CR6","unstructured":"Buterin, V.: Ethereum whitepaper (2013). https:\/\/Ethereum.org\/en\/whitepaper\/"},{"key":"3688_CR7","unstructured":"Antonopoulos, A.M., Wood, G.: Mastering Ethereum: Building Smart Contracts and Dapps. O\u2019Reilly (2018)"},{"key":"3688_CR8","doi-asserted-by":"publisher","unstructured":"Migliorini, S., Gambini, M., Combi, C., La Rosa, M.: The rise of enforceable business processes from the hashes of blockchain-based smart contracts. In: Enterprise, Business-Process and Information Systems Modeling, pp. 130\u2013138. Springer, Berlin (2019). https:\/\/doi.org\/10.1007\/978-3-030-20618-5_9","DOI":"10.1007\/978-3-030-20618-5_9"},{"key":"3688_CR9","doi-asserted-by":"crossref","unstructured":"Crafa, S., Di\u00a0Pirro, M., Zucca, E.: Is solidity solid enough? In: 3rd Workshop on Trusted Smart Contracts (WTSC\u201919). Lecture Notes in Computer Science, vol. 11599, pp. 138\u2013153. Springer, St. Kitts and Nevis (2019)","DOI":"10.1007\/978-3-030-43725-1_11"},{"key":"3688_CR10","unstructured":"Siegel, D.: Understanding the DAO attack (2016). https:\/\/www.coindesk.com\/understanding-dao-hack-journalists"},{"key":"3688_CR11","unstructured":"Cosmos: The internet of blockchains. https:\/\/cosmos.network"},{"key":"3688_CR12","unstructured":"Hotmoka\u2014blockchain and IoT with smart contracts in Java (2021). https:\/\/www.hotmoka.io"},{"key":"3688_CR13","unstructured":"Hyperledger\u2014open source blockchain technologies. https:\/\/www.hyperledger.org"},{"key":"3688_CR14","volume-title":"Java Generics and Collections","author":"M Naftalin","year":"2006","unstructured":"Naftalin, M., Wadler, P.: Java generics and collections. O\u2019Reilly Media (2006)"},{"key":"3688_CR15","doi-asserted-by":"publisher","unstructured":"Benini, A., Gambini, M., Migliorini, S., Spoto, F.: Power and pitfalls of generic smart contracts. In: Third International Conference on Blockchain Computing and Applications (BCCA\u201921), IEEE, Tartu, Estonia, pp. 179\u2013186 (2021). https:\/\/doi.org\/10.1109\/BCCA53669.2021.9657048","DOI":"10.1109\/BCCA53669.2021.9657048"},{"key":"3688_CR16","doi-asserted-by":"publisher","unstructured":"Odersky, M., Wadler, P.: Pizza into Java: translating theory into practice. In: Proceedings of the 24th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, pp. 146\u2013159 (1997). https:\/\/doi.org\/10.1145\/263699.263715","DOI":"10.1145\/263699.263715"},{"issue":"5","key":"3688_CR17","doi-asserted-by":"publisher","first-page":"11","DOI":"10.1145\/2345141.2248421","volume":"47","author":"O Sallenave","year":"2012","unstructured":"Sallenave, O., Ducournau, R.: Lightweight generics in embedded systems through static analysis. SIGPLAN Not. 47(5), 11\u201320 (2012). https:\/\/doi.org\/10.1145\/2345141.2248421","journal-title":"SIGPLAN Not."},{"key":"3688_CR18","unstructured":"Spoto, F.: Hotmoka Github repository. GitHub Inc (2018\u20132022). https:\/\/github.com\/Hotmoka\/hotmoka"},{"key":"3688_CR19","unstructured":"Kwon, J.: Tendermint: consensus without mining (2014). https:\/\/tendermint.com\/static\/docs\/tendermint.pdf"},{"key":"3688_CR20","volume-title":"A Discipline for Software Engineering","author":"WS Humphrey","year":"1995","unstructured":"Humphrey, W.S.: A Discipline for Software Engineering. Addison-Wesley Longman Publishing Co., Inc (1995)"},{"key":"3688_CR21","doi-asserted-by":"publisher","unstructured":"Murray, Y., Anisi, D.A.: Survey of formal verification methods for smart contracts on blockchain. In: 2019 10th IFIP International Conference on New Technologies, Mobility and Security (NTMS), pp. 1\u20136 (2019). https:\/\/doi.org\/10.1109\/NTMS.2019.8763832","DOI":"10.1109\/NTMS.2019.8763832"},{"key":"3688_CR22","doi-asserted-by":"publisher","unstructured":"Albert, E., Correas, J., Gordillo, P., Rom\u00e1n-D\u00edez, G., Rubio, A.: SAFEVM: a safety verifier for Ethereum smart contracts. In: Proceedings of the 28th ACM SIGSOFT International Symposium on Software Testing and Analysis, pp. 386\u2013389 (2019). https:\/\/doi.org\/10.1145\/3293882.3338999","DOI":"10.1145\/3293882.3338999"},{"key":"3688_CR23","doi-asserted-by":"publisher","unstructured":"Amani, S., B\u00e9gel, M., Bortin, M., Staples, M.: Towards Verifying Ethereum Smart Contract Bytecode in Isabelle\/HOL, pp. 66\u201377 (2018). https:\/\/doi.org\/10.1145\/3167084","DOI":"10.1145\/3167084"},{"key":"3688_CR24","doi-asserted-by":"publisher","unstructured":"Albert, E., Gordillo, P., Livshits, B., Rubio, A., Sergey, I.: EthIR: a framework for high-level analysis of Ethereum bytecode. In: Automated Technology for Verification and Analysis, pp. 513\u2013520 (2018). https:\/\/doi.org\/10.1007\/978-3-030-01090-4_30","DOI":"10.1007\/978-3-030-01090-4_30"},{"issue":"3","key":"3688_CR25","doi-asserted-by":"publisher","first-page":"396","DOI":"10.1145\/503502.503505","volume":"23","author":"A Igarashi","year":"2001","unstructured":"Igarashi, A., Pierce, B.C., Wadler, P.: Featherweight Java: a minimal core calculus for Java and GJ. ACM Trans. Program. Lang. Syst. (TOPLAS) 23(3), 396\u2013450 (2001). https:\/\/doi.org\/10.1145\/503502.503505","journal-title":"ACM Transactions on Programming Languages and Systems (TOPLAS)"},{"key":"3688_CR26","doi-asserted-by":"crossref","unstructured":"Spoto, F.: The Julia static analyzer for Java. In: Proceedings of the 23rd Static Analysis Symposium (SAS). Lecture Notes in Computer Science, vol. 9837, pp. 39\u201357. Springer, Edinburgh (2016)","DOI":"10.1007\/978-3-662-53413-7_3"},{"key":"3688_CR27","doi-asserted-by":"publisher","unstructured":"Li, A., Choi, J.A., Long, F.: Securing smart contract with runtime validation. In: Proceedings of the 41st ACM SIGPLAN Conference on Programming Language Design and Implementation, pp. 438\u2013453 (2020). https:\/\/doi.org\/10.1145\/3385412.3385982","DOI":"10.1145\/3385412.3385982"},{"key":"3688_CR28","doi-asserted-by":"publisher","unstructured":"Ayoade, G., Bauman, E., Khan, L., Hamlen, K.: Smart contract defense through bytecode rewriting. In: 2019 IEEE International Conference on Blockchain (Blockchain), pp. 384\u2013389 (2019). https:\/\/doi.org\/10.1109\/Blockchain.2019.00059","DOI":"10.1109\/Blockchain.2019.00059"},{"key":"3688_CR29","doi-asserted-by":"publisher","unstructured":"Zhang, Y., Ma, S., Li, J., Li, K., Nepal, S., Gu, D.: SMARTSHIELD: automatic smart contract protection made easy. In: IEEE 27th International Conference on Software Analysis, Evolution and Reengineering (SANER), pp. 23\u201334 (2020). https:\/\/doi.org\/10.1109\/SANER48275.2020.9054825","DOI":"10.1109\/SANER48275.2020.9054825"},{"key":"3688_CR30","doi-asserted-by":"publisher","unstructured":"Sergey, I., Nagaraj, V., Johannsen, J., Kumar, A., Trunov, A., Hao, K.C.G.: Safer smart contract programming with Scilla. Proc. ACM Program. Lang. 3\u00a0(OOPSLA). https:\/\/doi.org\/10.1145\/3360611","DOI":"10.1145\/3360611"}],"container-title":["Cluster Computing"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10586-022-03688-y.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10586-022-03688-y\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10586-022-03688-y.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,7,6]],"date-time":"2023-07-06T17:18:25Z","timestamp":1688663905000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10586-022-03688-y"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,8,9]]},"references-count":30,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2023,8]]}},"alternative-id":["3688"],"URL":"https:\/\/doi.org\/10.1007\/s10586-022-03688-y","relation":{},"ISSN":["1386-7857","1573-7543"],"issn-type":[{"type":"print","value":"1386-7857"},{"type":"electronic","value":"1573-7543"}],"subject":[],"published":{"date-parts":[[2022,8,9]]},"assertion":[{"value":"7 March 2022","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"3 May 2022","order":2,"name":"revised","label":"Revised","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"4 July 2022","order":3,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"9 August 2022","order":4,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare that they have no conflicts of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}},{"value":"This article does not contain any studies involving animals performed by any of the authors.","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethical standard"}},{"value":"This article does not contain any studies involving human participants performed by any of the authors.","order":4,"name":"Ethics","group":{"name":"EthicsHeading","label":"Informed consent"}}]}}